Cyber Insurance Adoption Surges Among Mid-Market Businesses While Small Firms Lag Behind
Mid-market businesses are rapidly closing ranks around purchasing cyber insurance while small businesses continue to lag, according to Nationwide’s Cybersecurity Survey Report.
The survey found that 73% of mid-market business owners now purchase cyber insurance, a 34-percentage-point increase since 2024. Small business owner adoption, by contrast, held at 42%. The report also found that 62% of mid-market business owners say their business has experienced a cyberattack, up 6 percentage points since 2024, compared with just 16% of small business owners, down 7 points since 2024.
Concern remains high across the board, with 68% of small business owners and 81% of mid-market business owners saying they are moderately or extremely concerned about a potential cyberattack.
A Widening Preparedness Gap
The survey identified a substantial readiness divide between small and mid-market firms. While 81% of mid-market business owners feel prepared to prevent a cyberattack, only 63% of small business owners say the same, according to the report.
That gap extends into workforce readiness: 95% of mid-market businesses provide formal cybersecurity training at least annually, compared with 72% of small businesses, and mid-market firms are more than twice as likely to run phishing tests at least every few months (65% versus 30%). Two-thirds of small business owners (66%) admitted they haven’t given much thought to what they would do if their business fell victim to a cyberattack, while 90% of small business owners with cyber insurance said they trust their coverage would take care of all their needs, compared with 77% of mid-market owners.
Among uninsured small business owners, 29% said they don’t know enough about cyber insurance and 24% didn’t know it was available, while uninsured mid-market owners more often cited cost (41%) or confidence in existing cybersecurity software (33%) as reasons for forgoing coverage.
A.I. Threats Are Outpacing Business Defenses
Generative A.I. is reshaping the threat landscape faster than businesses can respond, the report found. More than a quarter of small business owners (26%) and more than a third of mid-market owners (36%) said their company was targeted by a generative A.I. scam or fraud attempt in the past year, most often email impersonations of executives, employees, vendors or customers.
Among businesses that experienced any cyberattack, 55% of small business owners and 87% of mid-market owners said the attack was powered by or generated using A.I. About 90% or more of both groups agreed A.I. is making it easier for criminals to launch attacks at scale, and 88% of small business owners and 75% of mid-market owners said they need more information and resources to protect against A.I.-enabled cyberattacks.
Nearly every business that suffered an attack reported financial damage, cited by 91% of mid-market owners and 84% of small business owners, and hits to customer trust, with impact rates of 96% among mid-market owners and 97% among small business owners.
Agents See Themselves as Trusted Advisers, but Cite Client Gaps
Independent insurance agents report that cyber risk has become a central topic with commercial clients, with 79% saying commercial lines clients are moderately or extremely concerned about cyberattacks, compared with 62% for personal lines clients, according to the survey. Nine in 10 agents (89%) said they regularly recommend cyber insurance, and 90% believe clients view them as a credible source of cybersecurity information.
Yet agents estimate only 24% of commercial clients have an incident response plan in place and just 30% keep cyber coverage current with the evolving threat landscape. More than half of agents (52%) reported an increase in claims tied to generative A.I. scams or fraud in the past 12 months, but only 51% believe clients are prepared to identify and respond to A.I.-powered threats, and 62% said they need more information and resources to help protect clients from A.I.-enabled attacks.
Obtain the full report here. &

